Privacy policy

Who we are and what this covers

Karwan is a back-office service for e-commerce merchants: it receives their orders, books parcels with couriers, tracks deliveries and reconciles cash-on-delivery payments. It is run by Karwan Apps (“Karwan”, “we”). This policy covers the Karwan web application at ecommerce.karwanapps.com, the Karwan Ecommerce app for Shopify, the Karwan Apps app on Facebook, and the data Karwan handles for the merchants who use them.

A merchant using Karwan is the controller of their customers’ data; Karwan is the processor, acting on the merchant’s instructions. If you are a customer of a shop that uses Karwan, your relationship is with that shop; this page explains what Karwan does with your data on the shop’s behalf.

What Karwan reads from a connected store

When a merchant connects a Shopify or WooCommerce store, Karwan reads and keeps in step:

• Orders — order number, lines, amounts, payment method, status, notes, tags.
• Customer details on an order — name, delivery address, phone number and email address. These are what a courier needs to deliver a parcel and what the merchant’s team needs to confirm a cash-on-delivery order before it is booked.
• Products, variants, stock levels, locations and discounts — so that what the shop sells and has in stock matches Karwan.
• Fulfilments — so that a parcel booked in Karwan is shown as shipped in the shop, with its tracking number.

Karwan reads nothing from a store that has not been connected to a merchant’s workspace. The Karwan Ecommerce app for Shopify will not exchange a token for, or read anything from, a store Karwan has not approved.

Karwan does not read payment card numbers; Shopify and WooCommerce never share them.

What Karwan reads from Facebook, Instagram and WhatsApp

When a merchant logs in with Facebook and connects a Facebook Page, the Instagram account linked to it, or a WhatsApp Business number, Karwan reads and keeps:

• The Page or account itself — its name, ID and Instagram username, and an access token Meta issues so Karwan can act for it. The token is encrypted.
• Messages sent to the Page on Messenger, to the Instagram account, or to the WhatsApp number, and the replies sent from Karwan.
• The sender’s public profile — name, and username on Instagram, or phone number on WhatsApp — so the merchant knows who they are talking to.
• Posts and their comments — the post’s caption, image and link, and each comment’s text and author name, so the merchant can answer, hide or delete them.

Karwan uses these only to show the merchant’s team their conversations and comments in one inbox, send their replies, and, when the merchant asks, turn a conversation into an order. Karwan reads nothing from a Page or account the merchant has not connected, and nothing from the merchant’s personal Facebook profile beyond the list of Pages they manage.

What Karwan does with it

• Shows orders to the merchant’s team so they can verify and book them.
• Sends the consignee’s name, address and phone number to the courier the merchant books the parcel with, and prints them on the parcel label.
• Sends the customer order and delivery updates on WhatsApp, where the merchant has switched that on.
• Marks the order fulfilled in the shop with the courier’s tracking number, and updates its status as the courier reports.
• Reconciles the courier’s cash-on-delivery settlement against delivered parcels.
• Keeps a customer record per shop so repeat buyers and delivery reliability can be seen by the merchant.

Karwan does not sell data, use it for advertising, or use it for anything other than running the merchant’s operations.

Who it is shared with

• Couriers the merchant books with — Leopards, TCS, PostEx, Trax and M&P — receive the consignee’s name, address and phone number and the parcel’s contents and COD amount, under each courier’s own terms.
• Meta (WhatsApp Business Platform, Messenger and Instagram) carries the messages, replies and comment actions between a merchant and their customers that pass through Karwan, under Meta’s terms.
• OpenAI, only where a merchant switches on AI-drafted replies or reading an order from a chat and enters their own OpenAI key, receives the text of that conversation. A merchant who does not switch it on sends nothing to OpenAI.
• Amazon Web Services hosts Karwan in the Asia Pacific (Singapore) region. Data is encrypted in transit and at rest. Where a merchant without their own key asks Karwan to read an order from a chat, the conversation is read by a model on Amazon Bedrock in the same region, which Amazon does not use to train its models.
• Cloudflare sits in front of Karwan’s servers and carries every request to them, encrypted, to protect them from attack.
• Resend delivers Karwan’s own emails to merchants (sign-in links, invitations). Customers of a shop are not emailed through it.
• Odoo, where a merchant has connected their own accounting, receives invoices and settlements the merchant chooses to send.

Nobody else receives data from Karwan, except where the law requires it.

Requests from public authorities

When a government body, regulator or law-enforcement agency asks Karwan for someone’s data:

• We check that the request is lawful — that it comes from a body entitled to make it, under a law that allows it.
• We challenge a request we believe is unlawful or broader than the law allows, and disclose nothing until it is resolved.
• We disclose the least we can — only the data the request strictly requires.
• We keep a record of every request, our response, the legal grounds and who was involved.

How long it is kept

Order, parcel and settlement records are the merchant’s business records, so they are kept for the life of the workspace and for six years after it closes — the period Pakistani tax law requires business records to be kept. Everything else is kept only as long as it is needed:

• Store access tokens — deleted the moment a store is disconnected or the app is uninstalled. No new data arrives after that.
• Facebook Page and Instagram access tokens — deleted the moment the Page or account is disconnected in Karwan, which also stops Meta sending Karwan its messages and comments.
• Messages and comments — kept as the merchant’s records while the workspace is open, and erased within 30 days of a request as described below.
• A customer’s name, address, phone and email — erased within 30 days of a request from the merchant or through Shopify; the orders themselves stay, with those fields blank.
• A closed workspace’s customer data — erased within 30 days of the merchant asking, apart from what the law requires us to keep.
• Backups — nightly, encrypted, and expired after 35 days, so erased data leaves the backups within 35 days of leaving the database.
• Application logs — record who accessed which part of Karwan and when, never the data itself, and are kept for a bounded period on the server before being rotated away.

Disconnecting a store does not delete the orders already received, because the merchant still needs them. A merchant may ask for a store’s or a workspace’s data to be deleted at any time.

Your rights, and how to ask

If you are a customer of a shop that uses Karwan and want to see, correct or erase what Karwan holds about you, ask the shop: as the controller, it instructs Karwan, and Karwan carries the instruction out. A shop on Shopify can also make the request through Shopify, which sends it to Karwan automatically; Karwan records every such request and completes it within 30 days.

When a customer record is erased, the name, address, phone number and email on that customer’s orders are replaced with blanks; the orders themselves and their amounts are kept, because the merchant’s accounts depend on them. When a shop is deleted from Shopify, Karwan erases that shop’s customer details the same way.

Merchants can reach Karwan at info@karwanapps.com for any question about this policy or any request about their data. The commitments Karwan makes to merchants as their processor are in the terms of service.

Deleting data you shared through Facebook, Instagram or WhatsApp

If you are a merchant who connected a Facebook Page, Instagram account or WhatsApp number to Karwan:

• In Karwan, open Communication › Channels and disconnect the Page or Instagram account. Karwan deletes its access token at once and receives nothing more from it. A WhatsApp number is deactivated from the same screen; Karwan stops sending from it, and its access token is erased with the rest of its data on request, below.
• On Facebook, open Settings & privacy › Settings › Business integrations and remove Karwan Apps. This withdraws every permission you gave Karwan.
• To have the messages, comments and profiles already received erased as well, email info@karwanapps.com from the address you sign in to Karwan with, naming the Page, Instagram account or number. Karwan erases them within 30 days and replies to confirm when it is done.

If you messaged or commented on a shop’s Page, Instagram account or WhatsApp number and want what Karwan holds about you erased, ask the shop, or email info@karwanapps.com with the shop’s name and your Facebook or Instagram name, or your WhatsApp number. Karwan erases your messages, comments and profile details within 30 days and confirms by email. Backups expire within a further 35 days.

Security

Store credentials and access tokens are encrypted at rest with a key Karwan’s database never holds. Access to a workspace is by invitation and role. Every connection is over TLS. Karwan’s staff see a merchant’s data only to support that merchant or to carry out a request such as the ones above.

Changes

When Karwan starts reading something new from a store, sharing data with someone new, or keeping it for a different time, this page is updated and the effective date above changes. Merchants are told of a material change by email.